Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Apache log lines appearing out of sequence - why?

Tags:

apache

I've got an apache web server, and when a certain user accesses a certain page I get a log line who's timestamp is out of sync.

Sample output:

IP1 - - [22/Jun/2009:12:20:40 +0000] "GET URL1" 200 3490 "REFERRING_URL1" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)"

IP2 - - [22/Jun/2009:12:11:47 +0000] "GET URL2" 200 17453 "-" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.5; en-US; rv:1.9.0.11) Gecko/2009060214 Firefox/3.0.11"

IP3 - - [22/Jun/2009:12:20:41 +0000] "GET URL3" 200 889 "REFERRING_URL2" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; GTB6; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; 3P_USEC 1.0.11.2; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"

(I've anonymised requesting IPs - IP1, IP2 and IP3, requested URLs - URL1, URL2 and URL3, and the two referrrer URLs)

As can be seen the three lines (which appeared in the log in this order), are out of sync. This only happens when IP2 requests URL2 - all other logs seem normal.

Any ideas?

like image 996
PaulJWilliams Avatar asked Jun 22 '09 13:06

PaulJWilliams


People also ask

How do I change the Apache access log format?

The LogFormat directive controls the layout and formatting of log events. Apache uses the Common Log Format (CLF) by default, but you can specify your own format string to change the fields included in each log. You can also use the CustomLog directive to change the location of the log file.

What is the default path for Apache log messages?

By default, you can find the Apache access log file at the following path: /var/log/apache/access. log. /var/log/apache2/access.

How do I read apache2 logs?

On a Linux server, you can access Apache error logs from var/log/apache2/error. log. You can then log out the errors from the error log file by writing the following command: sudo tail -f /var/log/apache2/error.


1 Answers

The logs are written when the request is completed, so early long requests may be written after late short ones. Add %D to your LogFormat definition to see the time taken to serve the request, in microseconds.

See more here

like image 188
David Rabinowitz Avatar answered Sep 30 '22 05:09

David Rabinowitz